From b1e63009e5b2ff3cc674e504aaf09efae3196476 Mon Sep 17 00:00:00 2001 From: george m Date: Fri, 16 Jul 2021 12:25:22 +0100 Subject: [PATCH] updated keystore.go to use keystore-go to v4, fixed code and tests to handle breaking changes introduced by v4 --- go.mod | 2 +- go.sum | 3 +- .../internal/secretsmanager/keystore.go | 56 +++++++---------- .../internal/secretsmanager/keystore_test.go | 61 ++++++++++++++----- 4 files changed, 72 insertions(+), 50 deletions(-) diff --git a/go.mod b/go.mod index 92b2fa002..a39042b57 100644 --- a/go.mod +++ b/go.mod @@ -31,7 +31,7 @@ require ( github.com/munnerz/crd-schema-fuzz v1.0.0 github.com/onsi/ginkgo v1.16.4 github.com/onsi/gomega v1.14.0 - github.com/pavel-v-chernykh/keystore-go v2.1.0+incompatible + github.com/pavel-v-chernykh/keystore-go/v4 v4.1.0 github.com/pkg/errors v0.9.1 github.com/prometheus/client_golang v1.11.0 github.com/sergi/go-diff v1.1.0 diff --git a/go.sum b/go.sum index 395168199..be3372086 100644 --- a/go.sum +++ b/go.sum @@ -737,8 +737,7 @@ github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FI github.com/pascaldekloe/goe v0.1.0/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc= github.com/patrickmn/go-cache v2.1.0+incompatible h1:HRMgzkcYKYpi3C8ajMPV8OFXaaRUnok+kx1WdO15EQc= github.com/patrickmn/go-cache v2.1.0+incompatible/go.mod h1:3Qf8kWWT7OJRJbdiICTKqZju1ZixQ/KpMGzzAfe6+WQ= -github.com/pavel-v-chernykh/keystore-go v2.1.0+incompatible h1:Jd6xfriVlJ6hWPvYOE0Ni0QWcNTLRehfGPFxr3eSL80= -github.com/pavel-v-chernykh/keystore-go v2.1.0+incompatible/go.mod h1:xlUlxe/2ItGlQyMTstqeDv9r3U4obH7xYd26TbDQutY= +github.com/pavel-v-chernykh/keystore-go/v4 v4.1.0 h1:xKxUVGoB9VJU+lgQLPN0KURjw+XCVVSpHfQEeyxk3zo= github.com/pavel-v-chernykh/keystore-go/v4 v4.1.0/go.mod h1:2ejgys4qY+iNVW1IittZhyRYA6MNv8TgM6VHqojbB9g= github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtPdI/k= github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic= diff --git a/pkg/controller/certificates/internal/secretsmanager/keystore.go b/pkg/controller/certificates/internal/secretsmanager/keystore.go index 7a3ea115d..b061654e7 100644 --- a/pkg/controller/certificates/internal/secretsmanager/keystore.go +++ b/pkg/controller/certificates/internal/secretsmanager/keystore.go @@ -28,10 +28,9 @@ import ( "crypto/x509" "time" - jks "github.com/pavel-v-chernykh/keystore-go" - "software.sslmate.com/src/go-pkcs12" - "github.com/jetstack/cert-manager/pkg/util/pki" + jks "github.com/pavel-v-chernykh/keystore-go/v4" + "software.sslmate.com/src/go-pkcs12" ) const ( @@ -111,35 +110,29 @@ func encodeJKSKeystore(password []byte, rawKey []byte, certPem []byte, caPem []b } } - ks := jks.KeyStore{ - "certificate": &jks.PrivateKeyEntry{ - Entry: jks.Entry{ - CreationDate: time.Now(), - }, - PrivKey: keyDER, - CertChain: certs, - }, - } - // add the CA certificate, if set + ks := jks.New() + ks.SetPrivateKeyEntry("certificate", jks.PrivateKeyEntry{ + CreationTime: time.Now(), + PrivateKey: keyDER, + CertificateChain: certs, + }, password) + if len(caPem) > 0 { ca, err := pki.DecodeX509CertificateBytes(caPem) if err != nil { return nil, err } - - ks["ca"] = &jks.TrustedCertificateEntry{ - Entry: jks.Entry{ - CreationDate: time.Now(), - }, + ks.SetTrustedCertificateEntry("ca", jks.TrustedCertificateEntry{ + CreationTime: time.Now(), Certificate: jks.Certificate{ Type: "X509", Content: ca.Raw, - }, - } + }}, + ) } buf := &bytes.Buffer{} - if err := jks.Encode(buf, ks, password); err != nil { + if err := ks.Store(buf, password); err != nil { return nil, err } return buf.Bytes(), nil @@ -151,20 +144,17 @@ func encodeJKSTruststore(password []byte, caPem []byte) ([]byte, error) { return nil, err } - ks := jks.KeyStore{ - "ca": &jks.TrustedCertificateEntry{ - Entry: jks.Entry{ - CreationDate: time.Now(), - }, - Certificate: jks.Certificate{ - Type: "X509", - Content: ca.Raw, - }, - }, - } + ks := jks.New() + ks.SetTrustedCertificateEntry("ca", jks.TrustedCertificateEntry{ + CreationTime: time.Now(), + Certificate: jks.Certificate{ + Type: "X509", + Content: ca.Raw, + }}, + ) buf := &bytes.Buffer{} - if err := jks.Encode(buf, ks, password); err != nil { + if err := ks.Store(buf, password); err != nil { return nil, err } return buf.Bytes(), nil diff --git a/pkg/controller/certificates/internal/secretsmanager/keystore_test.go b/pkg/controller/certificates/internal/secretsmanager/keystore_test.go index 249cf9ce0..2164a9c58 100644 --- a/pkg/controller/certificates/internal/secretsmanager/keystore_test.go +++ b/pkg/controller/certificates/internal/secretsmanager/keystore_test.go @@ -23,13 +23,12 @@ import ( "fmt" "testing" - jks "github.com/pavel-v-chernykh/keystore-go" + cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" + "github.com/jetstack/cert-manager/pkg/util/pki" + jks "github.com/pavel-v-chernykh/keystore-go/v4" "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "software.sslmate.com/src/go-pkcs12" - - cmapi "github.com/jetstack/cert-manager/pkg/apis/certmanager/v1" - "github.com/jetstack/cert-manager/pkg/util/pki" ) func mustGeneratePrivateKey(t *testing.T, encoding cmapi.PrivateKeyEncoding) []byte { @@ -158,15 +157,33 @@ func TestEncodeJKSKeystore(t *testing.T) { return } buf := bytes.NewBuffer(out) - ks, err := jks.Decode(buf, []byte("password")) + ks := jks.New() + err = ks.Load(buf, []byte("password")) if err != nil { t.Errorf("error decoding keystore: %v", err) return } - if ks["certificate"] == nil { + + // if ks["certificate"] == nil { + // t.Errorf("no certificate data found in keystore") + // } + + // if _, certificate := ks.GetPrivateKeyEntry("certificate"); certificate == nil { + // t.Errorf("no certificate data found in keystore") + // } + + if !ks.IsPrivateKeyEntry("certificate") { t.Errorf("no certificate data found in keystore") } - if ks["ca"] != nil { + + // if ks["ca"] != nil { + // t.Errorf("unexpected ca data found in keystore") + // } + + // if _, ca := ks.GetTrustedCertificateEntry("ca"); ca != nil { + // t.Errorf("unexpected ca data found in keystore") + // } + if ks.IsTrustedCertificateEntry("ca") { t.Errorf("unexpected ca data found in keystore") } }, @@ -180,15 +197,23 @@ func TestEncodeJKSKeystore(t *testing.T) { t.Errorf("expected no error but got: %v", err) } buf := bytes.NewBuffer(out) - ks, err := jks.Decode(buf, []byte("password")) + ks := jks.New() + err = ks.Load(buf, []byte("password")) if err != nil { t.Errorf("error decoding keystore: %v", err) return } - if ks["certificate"] == nil { + // if ks["certificate"] == nil { + // t.Errorf("no certificate data found in keystore") + // } + if !ks.IsPrivateKeyEntry("certificate") { t.Errorf("no certificate data found in keystore") } - if ks["ca"] != nil { + + // if ks["ca"] != nil { + // t.Errorf("unexpected ca data found in keystore") + // } + if ks.IsTrustedCertificateEntry("ca") { t.Errorf("unexpected ca data found in keystore") } }, @@ -203,16 +228,24 @@ func TestEncodeJKSKeystore(t *testing.T) { t.Errorf("expected no error but got: %v", err) } buf := bytes.NewBuffer(out) - ks, err := jks.Decode(buf, []byte("password")) + ks := jks.New() + err = ks.Load(buf, []byte("password")) if err != nil { t.Errorf("error decoding keystore: %v", err) return } - if ks["certificate"] == nil { + // if ks["certificate"] == nil { + // t.Errorf("no certificate data found in keystore") + // } + if !ks.IsPrivateKeyEntry("certificate") { t.Errorf("no certificate data found in keystore") } - if ks["ca"] == nil { - t.Errorf("no ca data found in keystore") + + // if ks["ca"] == nil { + // t.Errorf("no ca data found in keystore") + // } + if !ks.IsTrustedCertificateEntry("ca") { + t.Errorf("unexpected ca data found in keystore") } }, },